Create a Computer Group query in Log Analytic based on TAGs for servers not running in Azure

Question

Hello,
Azure Automation Update Management feature looks into Log Analytic Computer Group Querys in order to use pre-defined groups defined by saved searches.

It seems that is it not possible to filter Non-Azure servers (i.e. servers imported in Azure as Azure ARC Server where log analytic agent has been installed ) by TAGs (as it is possible for Azure servers). May be ?

Is there a way to create a Computer Group in Log Analytic (that later will be used by Azure Update Management feature) based on TAGs (i.e. environment or cloud_provider ) ?

Thanks

Answer 1

Hi,
Tags information is not available in Log Analytics data by default or trough some of the built-in ingestions. Because of that there is no way to create computer group based on tags. You could potentially create some automation workflow (Azure Automation, Functions or Logic apps) which gets VM and tags data from Resource Graph and feed that data periodically to Log Analytics or directly update the query of the Kusto query behind the Computer group. In the first scenario you will use the data to create the query for Computer group, in the latter you will update the query with some static values to include the VMs in the query.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.